---
title: "Create an API Credential"
method: POST
path: "/v1/organizations/{organizationId}/api-credentials"
tags: ["apiCredentials"]
---

# Create an API Credential

`POST /v1/organizations/{organizationId}/api-credentials`

Create a new API Credential for the specified Organization.

## Path parameters

- `organizationId` string, required

## Request body

- ApiCredentialCreateRequestDTO
  - `name` string, required — Human-readable name of the API Credential.
  - `description` string, required — Brief description of the purpose and usage for the API Credential.
  - `enabled` boolean, required — If <code>true</code>, the API Credential is enabled. Otherwise, <code>false</code>.
  - `roles` ApiCredentialRolesSchema, required
    - `organizationRole` 'owner' | 'admin' | 'user', required — Organization-level Role assigned to the API Credential.
    - `workspaces` WorkspaceRoleSchema[] — Workspace-level Roles assigned to the API Credential.
      - `workspaceId` string, required — Unique ID of the Workspace.
      - `workspaceRole` 'owner' | 'admin' | 'user' | 'noaccess', required — Role assigned to the API Credential on the Workspace.
      - `products` ProductRoleSchema[] — Product-level Roles assigned to the API Credential for the Workspace.
        - `product` 'edge' | 'search' | 'stream' | 'lake' | 'insights', required — Product name.
        - `role` 'admin' | 'editor' | 'reader' | 'user' | 'noaccess', required — Role assigned to the API Credential on the product.
  - `ipAllowlist` string[] — CIDR range enforced as the IP allowlist for the API Credential.

## Response `201`

API Credential created

- ApiCredentialCreateResponseSchema
  - `name` string, required — Human-readable name of the API Credential.
  - `description` string, required — Brief description of the purpose and usage for the API Credential.
  - `enabled` boolean, required — If <code>true</code>, the API Credential is enabled. Otherwise, <code>false</code>.
  - `organizationId` string, required — Unique ID of the Organization.
  - `clientId` string, required — Client ID for the API Credential.
  - `roles` ApiCredentialRolesSchema, required
    - `organizationRole` 'owner' | 'admin' | 'user', required — Organization-level Role assigned to the API Credential.
    - `workspaces` WorkspaceRoleSchema[] — Workspace-level Roles assigned to the API Credential.
      - `workspaceId` string, required — Unique ID of the Workspace.
      - `workspaceRole` 'owner' | 'admin' | 'user' | 'noaccess', required — Role assigned to the API Credential on the Workspace.
      - `products` ProductRoleSchema[] — Product-level Roles assigned to the API Credential for the Workspace.
        - `product` 'edge' | 'search' | 'stream' | 'lake' | 'insights', required — Product name.
        - `role` 'admin' | 'editor' | 'reader' | 'user' | 'noaccess', required — Role assigned to the API Credential on the product.
  - `ipAllowlist` string[], required — CIDR range enforced as the IP allowlist for the API Credential. An empty array means that the API Credential has no IP restrictions.
  - `createdBy` string, required — Member who created the API Credential.
  - `createdDate` string, date-time, required — ISO 8601 timestamp when the API Credential was created.
  - `lastUpdatedBy` string, required — Member who last updated the API Credential.
  - `lastUpdatedDate` string, date-time, required — ISO 8601 timestamp when the API Credential was last updated.
  - `clientSecret` string, required — Client Secret for the API Credential. The Client Secret is sensitive information and should be kept private. Returned only in the <code>POST</code> response when the API Credential is created. Never returned in <code>GET</code> responses. If you need the Client Secret again, you must rotate credentials and retrieve the new Client Secret from the <code>POST</code> response.

## Other responses

- `409` — Could not create API Credential because it already exists
- `422` — API Credential limit reached
- `default` — Default error response

---

[API](https://skmtc.net/criblio/apis/cribl-cloud-public-api.md) · [All operations](https://skmtc.net/criblio/apis/cribl-cloud-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/criblio/cribl-cloud-public-api/revisions/6b74b2f0e495/schema)